ci: make release workflows respect branch protection (dispatch opens PR)

[jung-thomas]

Problem

Both release workflows' workflow_dispatch path pushes the version-bump commit directly to main (git push origin HEAD:main), which the branch-protection rulesets reject:

remote: error: GH013: Repository rule violations found for refs/heads/main

This broke one-click releases — v4.202607.0 had to be completed manually (bump via PR #164 → tag push). The tag-triggered publish path already works because only branches are protected, not tags.

Fix — two branch-protection-safe phases

1. Dispatch → opens a release PR (no push to main)
prepare calculates the version (scripts/prepare-release.js, unchanged), commits to a release/v<version> branch, and opens a PR into main via gh pr create.

2. Merge PR → auto-tag → publish
A new auto-tag job runs on push to main, reads package.json's version, and — if untagged — creates+pushes the version tag. Tags aren't branch-protected, so this succeeds and triggers the existing v* tag path → resolve-version → publish → mcp-registry (verified working during v4.202607.0).

Details

• publish / publish-mcp-registry decoupled from prepare (depend only on resolve-version); publish only runs on the tag path now.
• Job guards so a plain main push runs only auto-tag: test/resolve-version gated on the version-tag ref (v* / agent-v*) or dispatch.
• auto-tag is idempotent (no-op when the tag exists), so the shared push: branches: [main] trigger is harmless — each workflow tags only when its own package version changes. Confirmed no cross-triggering (v* ≠ agent-v* globs).
• Added pull-requests: write; removed the now-dead publish_mcp_registry dispatch input.
• Applied identically to release-agent-instructions.yml.

New release flow (documented for maintainers)

1. Run the Release workflow (Actions → Run workflow), optionally with version/changelog inputs.
2. Review + merge the auto-created release/v<version> PR.
3. auto-tag tags it → publish runs, gated by the existing npm-publish environment approval.

Verification

• ✅ Both workflows are valid YAML (yq), job guards traced for all three trigger scenarios (dispatch / main-push / tag-push).
• Full end-to-end (dispatch → PR → merge → publish) will exercise on the next real release; auto-tag is a safe no-op on ordinary main pushes until then.